27166 matches found
CVE-2026-28682 Gokapi: Data Leak in Upload Status Stream
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting...
CVE-2026-28682 Gokapi: Data Leak in Upload Status Stream
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting...
CVE-2026-28682 Gokapi: Data Leak in Upload Status Stream
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting...
CVE-2026-28682
Gokapi CVE-2026-28682 affects the self-hosted file sharing server Gokapi prior to 2.2.3. The vulnerability lies in the upload status SSE implementation for /uploadStatus, which previously published the global upload state to any authenticated listener and included file_id values not scoped to the...
CVE-2025-70233
creationtimestamp| type| source ---|---|--- 2026-03-06 02:42:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116179922591885034...
OpenClaw Information Disclosure Vulnerability (CNVD-2026-13370)
OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an information disclosure vulnerability. The vulnerability stems from the fact that skills.status may return raw parsed configuration values for the skills.config path via configChecks, which can be...
Gokapi Access Control Vulnerability
Gokapi is a lightweight, self-hosted alternative to Firefox sending by Marc Bulling. Versions of Gokapi prior to 2.2.3 contained an access control vulnerability. This vulnerability stemmed from the SSE implementation for upload status on /uploadStatus, which exposed the global upload status to an...
CVE-2026-28682: Improper Access Control
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting...
NewStart CGSL MAIN 6.06 (SP) : qemu Multiple Vulnerabilities (NS-SA-2026-0014)
The remote NewStart CGSL host, running version MAIN 6.06 SP, has qemu packages installed that are affected by multiple vulnerabilities: - A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a...
Linux SoC audio Heap Buffer Overflow DoS
The vulnerability of the hdadspdumpextromstatus function in the sound/soc/sof/intel/hda.c module, which is part of the Linux SoC audio support, involves copying buffers without checking their size—a classic buffer overflow attack. Exploiting this vulnerability could allow an attacker to compromis...
Rocket.Chat security vulnerability
Rocket.Chat is a chat software developed by the Rocket.Chat company. There were security vulnerabilities in versions prior to 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0. These vulnerabilities stemmed from authentication issues within the DDP Streamer service, where two-factor...
CVE-2026-29081
creationtimestamp| type| source ---|---|--- 2026-03-05 22:19:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgdtdzn4kv2k...
CVE-2026-0848
creationtimestamp| type| source ---|---|--- 2026-03-05 22:06:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgdsn3da7y2o 2026-03-06 22:56:29+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mggfvehltd2x 2026-03-07 15:00:45+00:00| seen|...
CVE-2026-28277 LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the upload status SSE implementation on /uploadStatus, which publishes global upload state to any authenticated listener and includes fileid values not scoped to the requesting user. A...
GHSA-C36C-7PC2-F2PH Gokapi has Data Leak in Upload Status Stream
Description The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting user. Impact Any authenticated user can observe other users' file identifiers and retrieve unauthorized...
Gokapi has Data Leak in Upload Status Stream
Description The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting user. Impact Any authenticated user can observe other users' file identifiers and retrieve unauthorized...
MINI-8P9C-8VJQ-7GHX
Bulletin has no description...